Question

A manufacturing company operates a converged network where corporate IT systems share infrastructure with the plant's operational technology (OT), including PLCs and SCADA controllers. A recent assessment found that a compromised IT workstation could directly reach the OT control network. The controllers run legacy protocols that cannot support host-based agents, encryption, or authentication, and they must exchange limited production data with an IT-based MES (Manufacturing Execution System). The security architect must design a segmentation approach that limits IT-to-OT exposure while still permitting the required data exchange. Which design best meets these requirements?

Accepted Answer

Deploy a demilitarized zone (DMZ) between the IT and OT networks with data brokers/historians that mediate all cross-boundary traffic, and enforce unidirectional or tightly filtered flows following an ISA/IEC 62443 zone-and-conduit model

Answer

Install endpoint detection and response agents on the PLCs and SCADA controllers and place them in the same VLAN as the MES to simplify data collection

Answer

Implement a flat network with a single next-generation firewall at the internet edge and rely on egress filtering to protect the OT devices

Answer

Require multifactor authentication directly on each PLC and SCADA controller before any IT system can query production data